CVE-2026-5271

pymanager included the current working directory in sys.path meaning modules could be shadowed by modules in the current working directory. As a result, if a user executes a pymanager-generated command (e.g., pip, pytest) from an attacker-controlled directory, a malicious module in that directory can be imported and executed instead of the intended package.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/python/pymanager/security/advisories/GHSA-jr5x-hgm4-rrm6	Exploit Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/04/01/5	Mailing List Third Party Advisory
https://github.com/python/pymanager/security/advisories/GHSA-jr5x-hgm4-rrm6	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:python:pymanager:26.0:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) pymanager incluyó el directorio de trabajo actual en sys.path, lo que significaba que los módulos podían ser solapados por módulos en el directorio de trabajo actual. Como resultado, si un usuario ejecuta un comando generado por pymanager (por ejemplo, pip, pytest) desde un directorio controlado por un atacante, un módulo malicioso en ese directorio puede ser importado y ejecutado en lugar del paquete previsto.

Information

Published : 2026-04-01 14:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-5271

Mitre link : CVE-2026-5271

CVE.ORG link : CVE-2026-5271

JSON object : View

Products Affected

python

pymanager

CWE

CWE-427

Uncontrolled Search Path Element

{"id": "CVE-2026-5271", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5271", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-01T17:58:52.079116Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@python.org", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.6, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@python.org", "affectedData": [{"repo": "https://github.com/python/pymanager", "vendor": "Python Software Foundation", "product": "pymanager", "versions": [{"status": "affected", "version": "26.0", "lessThan": "26.1", "versionType": "python"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-01T14:16:59.343", "references": [{"url": "https://github.com/python/pymanager/security/advisories/GHSA-jr5x-hgm4-rrm6", "tags": ["Exploit", "Vendor Advisory"], "source": "cna@python.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/04/01/5", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/python/pymanager/security/advisories/GHSA-jr5x-hgm4-rrm6", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-427"}]}], "descriptions": [{"lang": "en", "value": "pymanager included the current working directory in sys.path meaning modules could be shadowed by modules in the current working directory.\u00a0As a result, if a user executes a pymanager-generated command (e.g., pip, pytest)\n from an attacker-controlled directory, a malicious module in that \ndirectory can be imported and executed instead of the intended package."}, {"lang": "es", "value": "pymanager incluy\u00f3 el directorio de trabajo actual en sys.path, lo que significaba que los m\u00f3dulos pod\u00edan ser solapados por m\u00f3dulos en el directorio de trabajo actual. Como resultado, si un usuario ejecuta un comando generado por pymanager (por ejemplo, pip, pytest) desde un directorio controlado por un atacante, un m\u00f3dulo malicioso en ese directorio puede ser importado y ejecutado en lugar del paquete previsto."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:python:pymanager:26.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E4A6769E-1941-4B8E-8D05-6AADC5C52051"}], "operator": "OR"}]}], "sourceIdentifier": "cna@python.org"}